Passive scheme analysis for solving untrusted source problem in quantum key distribution 
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As a practical method, the passive scheme is useful to monitor the photon statistics of an untrusted source 
in a Plug & Play quantum key distribution (QKD) system. In a passive scheme, three kinds of monitor mode 
can be adopted: average photon number (APN) monitor, photon number analyzer (PNA), and photon number 
distribution (PND) monitor. In this paper, the security analysis is rigorously given for the APN monitor, while 
for the PNA, the analysis, including statistical fluctuation and random noise, is addressed with a confidence level. 
The results show that the PNA can achieve better performance than the APN monitor and can asymptotically 
approach the theoretical limit of the PND monitor. Also, the passive scheme with the PNA works efficiently 
when the signal-to-noise ratio (R SN ) is not too low and so is highly applicable to solve the untrusted source 
problem in the QKD system. 

PACS numbers: 03.67.Dd, 03.67.Hk 



I. INTRODUCTION 



Quantum key distribution (QKD) establishes two parties 
(Alice and Bob) to share a secure key [jTJ-[^] . The single- 
photon BB84 protocol HI for ideal and practical (im- 
perfect single-photon source, channel and detection) ifTolfTTll 
QKD systems has proved to be unconditionally secure in 
the last decade. To efficiently apply the security analysis of 
lUOlfllll . it is better that the photon-number distribution (PND) 
of the source is fixed and known to Alice and Bob, while 
Eve cannot control and change it. This kind of source is de- 
fined as a "trusted source" [see Fig.[Tfa)]. Due to channel loss 
and the multiphoton states of the trusted source, Eve can per- 
form the photon-number-splitting (PNS) attack Il2l - fl41 with- 
out causing any disturbances and obtain full information from 
the keys generated by the multiphoton states. Thus, all the 
losses and errors are pessimistically assumed from the single- 
photon state of trusted source and the secure key rate of QKD 
is reduced. Fortunately, with the decoy-state method Ill5l - [l9ll . 
the properties of the quantum channel are characterized by Al- 
ice and Bob, thereby higher secure key rate can be achieved 
|@], which has been successfully implemented in experiments 
for QKD with trusted source Il20l423ll . 

However, it was recently found that the characteristics of 
the QKD source need to be verified in a real-life experi- 
ment 024r - l34ll . For example, the intensity fluctuation from 
the source makes the assumption of the trusted source fail in 
decoy-state protocol, for which a rigorous security analysis 
has been given ll25l l27l l28ll . Especially, the assumption of a 
trusted source does not hold in the round-way "Plug & Play" 
system [35], in which Bob sends to Alice a train of bright laser 
pulses which can be eavesdropped and controlled by Eve. 
Even though Alice can use a time (frequency) -domain filter 
and phase randomizer 03611 to assure the mixture of single- 
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FIG. 1 : (a) Scheme of "trusted source", (b) Scheme of "untrusted 
source". 
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mode Fork states M24 1291 13011 . the PND of classically mixed 
states is under Eve's control provided that Eve has the power 
of a quantum nondemolition (QND) measurement 03711 and 
then she can know the photon number of each pulse sent to 
Alice's station. This kind of source is defined as an "untrusted 
source" [see Fig. [Tib)]. Note that Alice's filters, phase ran- 
domizer and encoder exist in Alice's side which are not shown 
in Fig. [Tib). Through QND in Fig.[Tfb), Eve knows the exact 
photon number at position 1, which may assist her PNS attack 
at position 2 j29tl . 

For applying the BB84 protocol in the experiment, an av- 
erage photon number (APN) monitor for an untrusted source 
was proposed Ir35ll . However, until now no quantitative and/or 
detailed analysis to prove the effectiveness of the method was 
reported. For keeping the efficient decoy-state analysis for 
an untrusted source, it was proposed to estimate the lower and 
upper bounds of a few parameters about the PND at position 2 
in Fig. Q2b) l25l l27i 12811 . Recently, the detector-decoy scheme 
was theoretically proposed to monitor the PND of untrusted 
source using a threshold detector ll3lll . From another view- 
point, an active scheme of the photon number analyzer (PNA) 
is put forward j29tl even though it is hard to put into reality 
IBOIl . In a recent work, a passive scheme of PNA was pro- 
posed and experimentally tested though some practical issues 
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FIG. 2: The passive scheme using a beam splitter (BS, transmittance: 
t B ), a detector (efficiency: t D ), an attenuator (transmittance: A), and 
an encoder. Here, the imperfect detector is modeled by a virtual at- 
tenuator between P3 and P4 (transmittance: t D ) and an ideal detector 
(efficiency: 100%). The encoder is used for phase coding. 



(e.g., statistical fluctuation and detection noise) were not con- 
sidered lT30tl . 

In the following, the security analysis is made for the APN 
monitor and the PNA. For the PNA, some practical issues, 
such as statistical fluctuation due to a finite number of mea- 
surements (estimated by the Clopper-Pearson confidence in- 
terval lf38L l39Tl ) and two kinds of additive detection noise 
(Poissonian and Gaussian electronic noise) are analyzed. It 
shows that the PNA has better enhancement in a secure key 
rate than the APN monitor and so is more applicable in BB84 
protocol. 



II. SECURITY ANALYSIS FOR THE APN MONITOR 

A passive scheme is illustrated in Fig. [2] where the detector 
is limited to monitor the APN (p) of the untrusted source and 
an attenuator (transmittance: A) is used to ensure the weak 
pulses with the fixed APN (such as 0. 1). This simple intensity 
monitor has been implemented to a practical "Plug & Play" 
system [35]. Applying the BB84 protocol without the decoy 
states, the security analysis of the untrusted source is pre- 
sented below. For convenience, in the following discussion, 
Pi with i = 1, . . ., refers to the position ;. In Fig. [2] the pho- 
toelectron number distribution D(m) at P4 and the PND P(«2) 
at P2 are the Bernoulli transform of PND P{n\) at PI, that is 

D(m) = B[P(m),£] = 2^(»i)Mra-fr" m , cd 

P(n 2 ) = B[P( ni ),T]] = J] P{ni)h\f\l-nT~ n \ (2) 

where r\ = A{\ - tg) and £ = tgtD- In practice, the intensity 
monitor of the detector only gives (m) = 2m=o m D(m). How- 
ever, based on Eq. (Q]), p = (n\) = (m)/g is known if (m) and 



£ are both exactly known. Then, from Eq. (O, the APN («2) 
(= rjp) at P2 can be derived. From the work of GLLP, BLMS: 
see authors of Refs. fill [Till . Alice should estimate the up- 
per (lower) bound of multiphoton (single-photon) probability 
at P2. For the untrusted source only under Alice's APN mon- 
itor, Eve can arbitrarily manipulate P(«i) with the constrains 
°f £^=o niP(n{) = p and 2^=o-P( n i) = 1- Eve chooses the 
optimal P(«i) to maximize the multiphoton probability at P2 
for eavesdropping more information by the PNS attack. Al- 
ice has to estimate the worst case and the upper bound of the 
multiphoton probability is estimated at P2, which is 

P(n 2 > l) = Y P (m)( ni W(i - t?)">- 2 + ■ ■ ■ 

W (3) 
= a 2 P(n\ = 2) + ■ • • + a k P{ri\ = k) + •• • , 

where = 1 -(1 —rj) k -kri(\ -r/) k ~ l (k > 2). Thus, to estimate 
the worst case, one needs to solve the convex optimization 
ll4Qh or linear program (LP) problem which has the form 



minimize - c x, 
subject to Ax — b, x > 0, 



(4) 



where 

x = [ P («, = 0) P(n x = 1) P(«i 
c T = [ a 2 ■■■ a k , ■■■], 

A = 



2) 



P(m =k) - ] 1 
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1 1 1 
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(5) 



The LP problem can be solved by using the simplex method 
lT4lTl and the maximum value P„ 2> \ of c T x is given as 



PfJ2>l 



Ok£_ 

k. ' 



(6) 



where a^Jk s is the maximum value of at/k, and the op- 
timal P{n\) of the untrusted source for Eve has the form 
[P( m = 0) = 1 -p/k s ,P(m = k s ) = fi/k s ,P(m * 0,k s ) = 0]. 
For example, if rj = 0.001 and p = 100 are fixed, 
the simplex method gives that P m >i = 0.02985 when 
P(m = 0) = 1 -/i/1794, P{n x = 1794) = /z/1794, and 
P(ni + 0, 1794) = 0. 

For an error-free setup with Bob's perfect detection (100% 
detection efficiency and no dark counts), the necessary condi- 
tion for security is 11311 



-r Pm>l , 

A= -QT <h 



(7) 



where Q e is the total expected probability of detection events 
and A is the upper bound of tagged signal probability ifTlll . 
Otherwise, Eve can suppress the single-photon signals com- 
pletely and obtain full information on the multiphoton sig- 
nals. In the "Plug & Play" system, the expected photon 
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source entering Alice's side is Poissonian with APN /i (i.e., 
Q e = I- e'^t). Here, rj f = \Q- a ' L / w [ s t h e transmittance of 
communication fiber with the loss a' (0.21 dB/km@ 1550 nm) 
and the length L. With ft = 100, 77 = 0.001, a' =0.21, and 
Pm>i = 0.02985, by Eq. (£7), the secure transmission distance 
L < 24.7 km. Note that, in the same setup, if Alice success- 
fully monitors the PND of the untrusted source at PI or P2 and 
Eve does not replace the Poissonian source, the secure trans- 
mission distance L < 63 km. Generally, for a practical "Plug 
& Play" setup with quantum bit error rate (QBER) E e , the se- 
cure key rate for an untrusted source with the APN monitor 
is 



d etector 



r>\q< 



-f(E e )H 2 (E e ) + (l-A) 



l-H 2 



1 - A 



(8) 



where f(E e )H2(E e ) is the leakage information in the error cor- 
rection and H2(x) - -xlog 2 x - (1 - x) log 2 (l - x). From the 
above analysis, one cannot find the secure key rate through 67 
km fiber in 13511 . 

The APN monitor does not require high detector resolu- 
tion. In the experiment, an optical power meter records the 
time average of the total pulse energy during one fixed period 
and is commonly used to monitor the mean optical power or 
APN (m). Due to finite average time, the measured values 
of the power meter may statistically fluctuate between differ- 
ent periods. Thus, one of the records from the power meter 
cannot represent the real (m) unless it has an infinite average 
time. However, when the running time of the QKD system is 
much longer than the average time of the power meter and the 
large number of records from the power meter are obtained, 
approximately, the mean of these records obeys the normal 
distribution according to the central limit theorem (CLT) 114211 . 
Through the mean and variance of these records, the real (m) 
can be statistically estimated in an interval [(m) L , {m) u ] with 
a confidence level M42I1 . Further, with the same confidence 
level, fi e [fi L ,fi u ] can be estimated, where fi L = (m) L /£ 
and fi u = {m) v /£. From Eq. ©, P« 2 >i can be estimated by 
a ks fj. u /k s . 



III. SECURITY ANALYSIS FOR THE PNA 

The passive setup in Fig.|2]can realize the PNA which leads 
to different analysis results [29]. By replacing the parameter A 
and randomly choosing the vacuum state and the signal (weak 
decoy) state with A s (Ad), the three-intensity decoy-state pro- 
tocol can be applied 13011 . 

The PNA needs to estimate the lower bound of the fraction 
1 - 6 of the photon pulses (defined as "untagged bits" and are 
originally referred to as PI in Fig. 2 B29IP . and the photon 
number N of which falls in the preset range of [N m i n , N mdx ]. 
To estimate 1 - 5, a detector needs to monitor the PND at P4, 
which is used to yield that at PI using the inverse-Bernoulli 
transform 13011 . Another important parameter to estimate the 
secure key rate is the transmittance A for "untagged bits" in 
Alice's side [for those at PI, A A = (1 - t B )A]. 

The effectiveness of inverse-Bernoulli-transform algorithm 
is sensitive to the statistical fluctuation and the detection noise, 




FIG. 3: A two- threshold detection for the PNA. The integrator con- 
verts the photoelectron number m to the voltage v. CI (C2): com- 
parator. "11" output from CI and C2 means the voltage v between 
Vi and \>2 and the photon number m falls in the range [m\ , m%], corre- 
spondingly. 



and high-resolution detection is required. To implement the 
passive scheme more robustly, the detection mode at P4 needs 
to be simplified, and the effects of statistical fluctuation and 
the detection noise need to be included in the security analy- 
sis. In doing so, a two-threshold detection illustrated in Fig. [3] 
is used and the position of "untagged bits" is redefined. In 
Fig. [3] through an integrator, the voltage v denotes the pho- 
ton number m which is detected by a common photodiode. 
Two comparators would output "11" when v 6 [vi, V2], which 
means the photon number m at P4 falls in [mi, m 2 ] where m\ 
and »?2 correspond to vi and v 2 , respectively. 

To discuss the position and transmittance of "untagged bits" 
in the passive scheme of a two-threshold detection mode, we 
consider three cases according to different parameters of the 
beam splitter (BS), attenuator, and detector in Fig. [2] 

Case I {t B to = 1 - t B ): The "untagged bits" are redefined as 
the photon pulses with photon number n$ e [m\ , w 2 ] 
at P5 in Fig. [2] Thus, the lower probability bound of 
1 —5 (= 2"i5=m, P( n 5)) °f tne "untagged bits" needs to be 
estimated. Note that t B t D = l-t B , P(« 5 ) (= B[P(n{), (1- 
t B )]) at P5 is equal to D(m) (= B[P(rii), t B t D ]) at P4 in 
Fig. [2] Thus, 1 - 5 is estimated by Ylm=m D( m ) and 
,1' - " 

Case II (A < t B t D /(l - t B ) < 1): The attenuator A in Fig. [2] 
is virtually replaced by two cascaded attenuators A' 
[= t B to/(i - t B )] and A" (= A/A'), in which the secu- 
rity is not reduced. A virtual passive scheme [Fig. Ufa)] 
is equivalent to that of Fig. [2] because the PND at PI is 
the same as that at P2, P3, P4, P5 and P6 in both passive 
schemes. Note that A" < 1 requires A < t B to/(l -t B ) for 
the BB84 protocol and A d < A s < t B t D /(l - t B ) for the 
decoy-state protocol. In Fig. Ufa), the "untagged bits" 
are defined as the photon pulses with photon number 
«7 € [mi, m 2 ] at P7. Thus, the lower probability bound 
of 1 - 8 ( = Yjnj= mi P( n i)) °f "untagged bits" needs to 
be estimated. Note that t B t D = (1 - t B )A' , P{n-,) at P7 is 
equal to D(m) at P4 in Fig. Ufa). Thus, 1 -5 is estimated 
by Zm 2 =m, D(m) and A A = A" = (1 - t B )A/(t B t D ). 

Case III (t B t D > 1 - t B ): The BS in Fig. |2] is virtually re- 
placed by two beam splitters (BS 1 and BS2) and a beam 
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FIG. 4: The virtual passive schemes equivalent to Fig. [2] for Cases II and III. (a) Both X (= t B t D /(l - t B )) and A" (= A./X) are the cascaded 
attenuators which replace A of Fig. [2] (b) BS1: beam splitter (transmittance, 1 - t B t D )\ BS2: beam splitter (transmittance, (1 - t B )/(t B t D )); BC: 
beam combiner. BS1, BS2 and BC replace the BS of Fig.[2] 



combiner (BC) [Fig.Htb)] because the PND at PI is the and p u (x, a), respectively, are defined by 
same as that at P2, P3, P4, P5 and P6 in both passive 

schemes. In Fig. Sb), the "untagged bits" are defined m 

as the photon pulses with photon number n 7 e [mi,m 2 ] V J \pj(x, a) [1 - pi(x, a)] M ~ j = —, (1 < x < M); 

at P7. Note that P(nj) at P7 is equal to D(m) at P4 in \ J ' I 2 

Fig. Efb). Thus, the lower probability bound of 1 — 8 * , > 

(= 2™ 2 = mi P{ni)) of the "untagged bits" is estimated by . \p{{x, a) [1 - p u (x, a)] M ~ j = |, (0 < x < M - 1); 

YZl m D(m)<maA A = (\-t B )AI(t B t D ). >° U 

P[ (0,a)=0, p u (M,a) = l. (9) 



The general form of A A for the above cases is thus (1 - 
tB)A/(tBtD), which is also derived in l43ll . Note that, in our 
method, the lower bound of Y!m=m x D(m) should be estimated 
by the measured data from the detection mode shown in Fig. [3] 



Obviously, from the Lemma, one has 

Prob(pi(k, a)<p< p u (k, a)) = 1 - a. (10) 

Thus, 1 - 6 or p can be lower bounded by p/(k, a) with a confi- 
dence level 1 - a, while p/{k, a) can be easily calculated using 
the MATLAB program. 



A. PNA without detection noise 

Let the random variable R = 1 denote that C 1 and C2 out- 
put "11", otherwise R — 0. Thus, R follows the binomial 
distribution B(l,p). Without any detection noise in Fig. [3j 
P = Zmimi D(m) = 1-5. After M repeating measurements, 
let the random variable X = k denote k measurements finding 
R = 1 and then X follows the binomial distribution B(M,p). 
Statistically, k/M fluctuates around p. To estimate the statisti- 
cal fluctuation, we give the following Lemma. 

Lemma. (Clopper-Pearson Confidence Interval j38l l39ll ) 
Let X be the number of successes in M Bernoulli trials with 
probability p of success on each trial. The Clopper-Pearson 
(1 - a) confidence interval for p is obtained as follows: If 
X = x is observed, then the lower and upper bounds pi(x, a) 



B. PNA with known and additive detection noise 

In practice, some detection noise exists in Fig.[3]and affects 
the estimation of 1 - 6. Here, it is supposed that the properties 
of detection noise are known by Alice and are independent 
of signal detection. Two kinds of noise are mainly concerned. 
One is Poissonian noise or dark counts from the detector itself. 
The other is Gaussian electronic noise generated by electronic 
devices such as the integrator and comparators in Fig. [3] Let 
the random variables m' , m and d (or x) be measured data, 
true photon number, and additive Poissonian noise (Gaussian 
electronic noise) and satisfy 

m — m + d, m — m + x. (11) 
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For the Poissonian noise d of the probability N(d) — 
evp(—y)y d I d\, based on Eq. ( TTTT i, one yields 

mi— 1 mi— m 

P{m\ < to' < mi) = ^ D{m) V N(d) 

m=0 d=m\~m 
mi m-i—m 

+ £ D(m) £ iV(rf). (12) 



d=0 



Let 



I //r7 tit ( 

Z?(rai , m2) = max i ^ m = 0, . . . ,mj - 1 

rf=0 



(13) 



Note that b(TO2) > b{m\,mi). Combining Eqs. ( fT2l ) and ( fT3l , 
one has 

P(m\ < to' < mi) < b{m\,mi) ^ D(m) + b(m%) ^ D(m) 



< b(mi,mi) 

= b(mi,mi) 
which gives 



m=m\ 



Y D(m) + V £>(ra) + £(to 2 ) V D(m) 

m=0 m=m2 + \ \ m=m\ 

mi mi 

1 - ^ D(m) +b{m 2 ) ^ D(m), (14) 



1-5=2 D(m) " 



-P(oti < m! < mi) — b(m\,mi) 
b(mi) — b{m\,mi) 



After M measurements of to', if one finds k! events from the 
binomial distribution B(M, p'), according to the Lemma, 



Pmb(p,(k',a) < p' < p u (k',a)) = 1 - a, 



(16) 



where p' = P{m\ < to' < mi). From Eqs. ( fT5l ) and (fl~6]l, 1-5 
can be lower bounded by 



1 -6 > 



pi(k' , a) — b(m\,mi) 



(17) 



b(mi) — b{m\,mi) 

with a confidence level 1 - a. 

For the case of electronic noise x of the Gaussian probabil- 
ity G(x) = (27rcr 2 )- 1 / 2 exp[ - x 2 /(2cr 2 )], based on Eq. O, 
one yields 

f(mi < to' < TO2) = ^ I G(x)dx 



m 2 pi, 



G(x)dx + 



m=m 
mi — 1 



00 /-V7J2 -m 

,1 ^mi —m 



G(x)dx 



m— m2 + l 



2 0(m) I G(x)dx + 2 fl ( ffl ) f 

00 ~ 
1 1 Jm 



m\ —m 
>(m2-mi)/2 

( 

-(m 2 -mi)/2 



To derive the above inequality, the property that G(x) is single- 
peak function symmetrical at zero is used. Let 



pm2-m\ p(m2~m\)l2 

b\ — I G(x)dx, bi = I 
Jo J-i 



G(x)dx, 



(m2-mi)/2 



bi 



f 

*Jm\ —n 



(19) 



G(x)dx, 



lm\—m2-\ 

and b2 >b\ > b?,. Equation ( TT~8T > then changes to 
P(m\ <m'< mi) 



<b. 



<b. 



bi 



2 D o») 



m=m.2+l 



2 D(m) +fe ^ D(m) 

m=0 J \m=m\ 

m\-\ 00 

^ 0(m) + ^ D ( m ) +fc 2 ^ 0(m) 

m=0 m=ni2 + l J 

ffl? [ m? 

1 - 2 £>( m ) +*2 ^ £>(to) 



Thus, we get 



••VL 

1 - 5 = V D(m) > 



f(mi <m'< mi) — b\ 
b; - b\ 

Similar to Eq. ( fTTI i. 1-5 can be lower bounded by 

pi(k',a) - b\ 



l-S> 



b 2 -bi 



(20) 



(21) 



(22) 



(15) with a confidence level I — a. 



IV. NUMERICAL SIMULATIONS 

Based on the BB84 protocol, Fig. [5] shows the numerical 
simulation results for a trusted source and an untrusted source 
with an APN monitor and PNA. In the simulations, both the 
trusted and untrusted sources are of Poissonian PND. The 
APN (p.) of the untrusted source is 10 6 . We use the passive 
scheme of f# = 0.9 and to = 0.76 to implement the APN 
monitor and PNA without considering statistical fluctuation 
and detection noise. Figure |5{a) shows the result with the 
experimental parameters in Il44ll (see Table Q), where rj B is 
the efficiency of Bob's detection, To is the dark-count rate 
of Bob's detector, and e,j et (eo) is the probability that a pho- 
ton (dark count) hit the erroneous detector in Bob's side. In 
Fig. |5J a), we choose the optimized value of 77 = (j]Bt]f)/p for 
both the trusted and untrusted sources, f(E e ) = 1 for perfect 
error correction and [m\, mi[ = [677160, 690840] for the de- 
tection thresholds in Fig. [3] Q e and E e are given by lfl9Tl 



G(x)dx. 



G(x)dx 



(18) 



Q e = To + 1 - exp(-yu?7^^/), 

e Y + edetP - exp(-ju?7?7i,?7/)] 



E„ = 



(23) 



Qe 



i m\—m2 — \ 



Note that, from Fig. |3 a X no secure key rate with an APN 
monitor is generated at any distance, while the secure key rate 
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FIG. 5: (Color online) The simulations of the BB84 protocol for the 
trusted source and untrusted source with the APN monitor and PNA. 
(a) n = (rj B rif)/fi and parameters in j44ll are used, (b) n = 1CT 7 , 
n B = 0.5 and other parameters are the same as f44ll . 



FIG. 6: (Color online) The simulations of three-intensity decoy-state 
protocol for a trusted source and untrusted source with PNA with 
different detection noise, run by M = 10 8 and a = 1CT 6 . (a) Pois- 
sonian noise with the average photon number y = 10 6 , . . . , 7 x 10 6 . 
(b) Gaussian electronic noise with variance a 1 = 10 9 , . . . , 7 x 10 10 . 



TABLE I: The simulation parameters for Fig.[5Ja). 





t B 


to 




a' 


Y 


edci 


eo 


10 6 


0.9 


0.76 


0.045 


0.21 


1.7 x 10-" 


3.3% 


0.5 



with PNA is found close to the value of the trusted source. 
For comparing the APN monitor with PNA more visibly and 
fairly, Fig. [2b) shows the result with fixing rj = 10~ 7 and re- 
setting j] B = 0.5. Other simulation parameters are the same 
as those in Table U Using these parameters, one can fix 
Pn 2 >i = 0.029843 to calculate the secure key rate with the 
APN monitor. From Fig. |5jb), the secure distance is shown 
to be less than 1 km with the APN monitor. Fortunately, 
PNA improves the performance which approaches that of the 
trusted source. 

For testing the effects of statistical fluctuation and detec- 
tion noise on PNA, we choose an untrusted source of Poisso- 
nian statistics to perform the simulations based on the three- 
intensity decoy-state protocol. In the passive scheme as in 
Fig- El fg and t D are chosen as 0.9 and 0.76, respectively. The 
APN of the untrusted source is 1.462 x 10 7 . Thus, (m) at 
P4 is 10 7 . For applying the decoy-state protocol, the average 



photon number for a signal (weak decoy) state is v s = 0.5 
(vj = 0.1). In doing so, the transmittance of the attenuator 
is A s = 3.42 x 10~ 7 (A d = 6.84 x 10~ 8 ) for the signal (weak 
decoy) state. The photoelectron detection and additive detec- 
tion noise generated in Fig. [3] are simulated using the Monte 
Carlo method and M - 10 8 of measurements are run. Other 
parameters are chosen from 114411 and summarized in Table ITT1 

With different Poissonian noise (y = 10 6 , . . . ,7xl0 6 ) added 
in the PNA, each color line in Fig. |6ja) shows the secure 
key rate for the untrusted source. For comparison, the black 
dashed line shows the secure key rate for the trusted source 
with the same setup. Here, the confidence level 1 - a is cho- 
sen as 1 - 10~ 6 and the minimal (maximal) value of detected 
m' is chosen as mi (mj), by which pi(M, a) = (a/2) l ^ M can be 
substituted to Eq. ( fT71 ) according to the Lemma. 

With different Gaussian electronic noise (cr 2 = 10 9 ,...,7X 
10 10 ) added in PNA, each color line in Fig. |6|b) shows the 
secure key rate for untrusted source. The method of choosing 
a, mi, and ni2 is the same as that of Poissonian noise. 
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TABLE II: The simulation parameters for Fig. [6] 





Vd 


t B 


to 


(m) 


M 






IB 


a' 


I'd 


fidct 




0.5 


0.1 


0.9 


0.76 


10 7 


10* 


3.42 x 10~' 


6.84 x lO" 8 


0.045 


0.21 


1.7 x 10-" 


3.3% 


0.5 



V. CONCLUSION 

In the passive scheme as in Fig.|2l a different monitor mode 
at P4 gives different statistical characteristics of the untrusted 
source and affects the performance of the QKD system. It is 
shown from Fig. [5] that the PNA can enhance the QKD per- 
formance better than the APN monitor because PNA utilizes 
the two-threshold detection as in Fig. [3] Asymptotically, if 
the photon statistics at PI can be fully characterized through a 
photon-number-resolving (PNR) detector at P3 and the PND 
monitor can be realized, the GLLP's analysis for the trusted 
source can be efficiently applied and the results are shown 
as the black dashed line in Figs. [5] and [6] Without consid- 
ering the statistical fluctuation and detection noise, the secure 
key rate through PNA approaches that of an ideal PND mon- 
itor except at a long distance. What is more important is that 
the two-threshold detection mode of PNA is easier to realize 
than the PNR detector. Besides, it is also found from Fig. [6] 
that too large a random noise added in the PNA's detection 
would degenerate the QKD performance. Thus, for improving 
the secure key rate, the signal-to-noise ratio (SNR) in Fig. [3] 
needs to be kept in an applicable level. For example, in our 
simulations, R^ N = {m)jy and R^ N = (m)/cr 2 can be cal- 



culated for Poissonian and Gaussian electronic noise, respec- 
tively. From Fig. [6j if the QKD distance would exceed 120 
km, then R s p N > 2.5 and R s g N > 5 x 1(T 4 are needed and is 
achievable in practice. Therefore, the passive scheme with 
PNA is highly practical to solve the untrusted source problem 
in the "Plug & Play" QKD system. 

We remark that the effect of parameter fluctuations has 
not yet been included in the security analysis. The effective 
method to deal with the parameter fluctuations i25l - l28ll is en- 
couraged to be applied in the passive scheme. 

Note added. For passive scheme, the security analysis with 
considering statistical fluctuation and detection noise for PNA 
is given with using different techniques [43]. 
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